N H A C E R T I F I E D C L I N I C A L M E D I C A L A S S I S TA N T
CCMA Certification
Exam Review Guide
A comprehensive 150-question practice examination
aligned with the 2026/2027 NHA CCMA blueprint.
Scenario-based clinical decisions, procedure
sequences, and detailed rationales double as study
content for certification preparation.
150 Questions · Answer Key · Detailed Rationales
Foundational Knowledge · Clinical Patient Care · Administration · Law and Ethics
2026/ 2027 ED I TI ON · NHA C C MA EXAM B L UEPRI NT
,CCMA Certification Exam Review Guide 2026/2027
Certified Clinical Medical Assistant - Comprehensive Practice Examination
150 Questions | Answer Key with Detailed Rationales | Aligned with the 2026/2027 NHA CCMA Exam Blueprint
SECTION 1 Questions 1-16
Foundational Knowledge, Law, and Ethics (HIPAA, Scope of Practice, and Patient
Rights)
Q1: Which of the following is the PRIMARY source that defines the scope of practice for a medical assistant?
A. The employer's office policy manual
B. State laws and medical board regulations [CORRECT]
C. The certifying body's code of ethics
D. Preferences of the supervising physician
Correct Answer: B
Rationale: Scope of practice for medical assistants is legally established by state statutes and the regulations of the
state medical board, which dictate which clinical and administrative duties may be delegated to unlicensed personnel.
Employer policies, physician preferences, and certification codes refine daily duties but cannot expand practice beyond
what state law allows. Delegating or accepting duties outside the legal scope exposes both the assistant and the
employer to liability.
Q2: During a busy clinic session, a provider asks a medical assistant to examine a patient's suspicious mole,
determine whether it is malignant, and recommend a treatment plan. Which action should the medical assistant
take?
A. Perform the assessment because the provider gave a direct order
B. Perform the assessment but document that the provider ordered it
C. Politely explain that diagnosing is outside the medical assistant's scope and inform the
provider [CORRECT]
D. Ask another medical assistant to complete the examination instead
Correct Answer: C
Rationale: Assessment for diagnosis and treatment planning is the legal practice of medicine; medical assistants may
collect data and assist but may never diagnose, interpret findings, or prescribe. The correct professional response is to
decline the task courteously and notify the provider so that the provider personally performs the examination. Options
A and B constitute practicing medicine without a license, and asking a peer (D) simply transfers an out-of-scope task to
another unlicensed person.
CCMA Exam Review Guide 2026/2027 - NHA Aligned 1
,CCMA CERTIFICATION EXAM REVIEW GUIDE 2026/2027
Q3: Which set correctly lists the four elements, sometimes called the four Ds, that a plaintiff must prove in a
medical malpractice (negligence) lawsuit?
A. Duty, dereliction of duty, direct cause, damages [CORRECT]
B. Duty, documentation, diagnosis, damages
C. Deviation, denial, delay, damages
D. Duty, disclosure, decision, damages
Correct Answer: A
Rationale: To succeed in a negligence claim the plaintiff must prove that a duty of care existed, that the provider
breached (derelicted) that duty, that the breach directly caused the injury, and that actual damages resulted.
Documentation, diagnosis, disclosure, and the other combinations in options B, C, and D are not the recognized legal
elements and are common distractors that confuse study habits with legal proof requirements.
Q4: A patient signs a form consenting to a minor office procedure after the provider explains the risks, benefits,
and alternatives. This is an example of which type of consent?
A. Implied consent
B. Informed refusal
C. Verbal consent only
D. Expressed consent [CORRECT]
Correct Answer: D
Rationale: Expressed consent is given orally or in writing after the patient has been informed; a signed consent form is
written expressed consent. Implied consent (A) is assumed from a patient's actions, such as extending an arm for
venipuncture, or in emergencies when an unconscious patient cannot consent. Options B and C do not describe a signed
consent transaction, and the scenario specifically documents written agreement after full disclosure.
Q5: Under the HIPAA Privacy Rule, a medical assistant may disclose protected health information (PHI) for
treatment, payment, and health care operations without special authorization. When information is needed for any
other purpose, which principle applies?
A. The information may be shared freely with any health-related business
B. The minimum necessary standard and patient authorization requirements apply [CORRECT]
C. Only verbal permission from a supervisor is needed
D. The information must be released within 24 hours upon any request
Correct Answer: B
Rationale: HIPAA requires that disclosures outside treatment, payment, and operations (TPO) be limited to the
minimum necessary information and generally supported by the patient's written authorization. Option A describes
impermissible sharing, option C ignores the requirement for patient authorization, and option D inverts the rule by
creating an arbitrary deadline that HIPAA does not contain. The minimum necessary standard does not apply to
disclosures for treatment.
CCMA Exam Review Guide 2026/2027 - NHA Aligned 2
, CCMA CERTIFICATION EXAM REVIEW GUIDE 2026/2027
Q6: A medical assistant wants to review the electronic health record of her own child who was seen in the clinic
yesterday. She has legitimate EHR access but no treatment role. Which statement is correct?
A. She may view the record because she is the child's parent
B. She may view only the laboratory results section
C. Accessing the record without a job-related reason and proper authorization violates
HIPAA [CORRECT]
D. She may view the record if she does not share what she reads
Correct Answer: C
Rationale: HIPAA forbids accessing PHI without a business need tied to one's job duties; curiosity, including interest
in one's own or a family member's care, is a well-known audit trail violation that can result in termination and civil
penalties. Parental rights to the child's record must be exercised through the proper release process, not through
personal EHR access. Options A, B, and D all permit unauthorized access simply because the information will not be
shared, which HIPAA does not allow.
Q7: An attorney requests copies of a patient's chart for a lawsuit. Which of the following must the office obtain
before releasing the records?
A. A written patient authorization or valid subpoena/court order meeting state requirements [CORRECT]
B. Nothing, because attorneys are exempt from HIPAA
C. Only a telephone call from the attorney's office
D. A notarized statement from the provider
Correct Answer: A
Rationale: Legal disclosures are outside treatment, payment, and operations, so the office must have the patient's
signed written authorization or a legally valid subpoena, court order, or statutory demand before releasing records.
Attorneys are not HIPAA exempt entities (B), a phone request (C) provides no documentation or verification, and a
provider's notarized statement (D) has no legal standing to authorize release. The response should be verified against
state law and office policy.
Q8: Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals of a breach of
unsecured PHI within what maximum time frame?
A. Within 5 business days of discovery
B. Within 30 days of the end of the calendar year
C. Within 1 year of discovery
D. Without unreasonable delay and no later than 60 days after discovery [CORRECT]
Correct Answer: D
Rationale: The Breach Notification Rule requires individual notification without unreasonable delay and in no case
later than 60 calendar days from discovery of the breach, with larger breaches also reported to HHS and, for 500 or
more individuals, to the media. Options A, B, and C are fabricated time frames that confuse breach notification with
other regulatory deadlines, making them classic exam distractors.
CCMA Exam Review Guide 2026/2027 - NHA Aligned 3
CCMA Certification
Exam Review Guide
A comprehensive 150-question practice examination
aligned with the 2026/2027 NHA CCMA blueprint.
Scenario-based clinical decisions, procedure
sequences, and detailed rationales double as study
content for certification preparation.
150 Questions · Answer Key · Detailed Rationales
Foundational Knowledge · Clinical Patient Care · Administration · Law and Ethics
2026/ 2027 ED I TI ON · NHA C C MA EXAM B L UEPRI NT
,CCMA Certification Exam Review Guide 2026/2027
Certified Clinical Medical Assistant - Comprehensive Practice Examination
150 Questions | Answer Key with Detailed Rationales | Aligned with the 2026/2027 NHA CCMA Exam Blueprint
SECTION 1 Questions 1-16
Foundational Knowledge, Law, and Ethics (HIPAA, Scope of Practice, and Patient
Rights)
Q1: Which of the following is the PRIMARY source that defines the scope of practice for a medical assistant?
A. The employer's office policy manual
B. State laws and medical board regulations [CORRECT]
C. The certifying body's code of ethics
D. Preferences of the supervising physician
Correct Answer: B
Rationale: Scope of practice for medical assistants is legally established by state statutes and the regulations of the
state medical board, which dictate which clinical and administrative duties may be delegated to unlicensed personnel.
Employer policies, physician preferences, and certification codes refine daily duties but cannot expand practice beyond
what state law allows. Delegating or accepting duties outside the legal scope exposes both the assistant and the
employer to liability.
Q2: During a busy clinic session, a provider asks a medical assistant to examine a patient's suspicious mole,
determine whether it is malignant, and recommend a treatment plan. Which action should the medical assistant
take?
A. Perform the assessment because the provider gave a direct order
B. Perform the assessment but document that the provider ordered it
C. Politely explain that diagnosing is outside the medical assistant's scope and inform the
provider [CORRECT]
D. Ask another medical assistant to complete the examination instead
Correct Answer: C
Rationale: Assessment for diagnosis and treatment planning is the legal practice of medicine; medical assistants may
collect data and assist but may never diagnose, interpret findings, or prescribe. The correct professional response is to
decline the task courteously and notify the provider so that the provider personally performs the examination. Options
A and B constitute practicing medicine without a license, and asking a peer (D) simply transfers an out-of-scope task to
another unlicensed person.
CCMA Exam Review Guide 2026/2027 - NHA Aligned 1
,CCMA CERTIFICATION EXAM REVIEW GUIDE 2026/2027
Q3: Which set correctly lists the four elements, sometimes called the four Ds, that a plaintiff must prove in a
medical malpractice (negligence) lawsuit?
A. Duty, dereliction of duty, direct cause, damages [CORRECT]
B. Duty, documentation, diagnosis, damages
C. Deviation, denial, delay, damages
D. Duty, disclosure, decision, damages
Correct Answer: A
Rationale: To succeed in a negligence claim the plaintiff must prove that a duty of care existed, that the provider
breached (derelicted) that duty, that the breach directly caused the injury, and that actual damages resulted.
Documentation, diagnosis, disclosure, and the other combinations in options B, C, and D are not the recognized legal
elements and are common distractors that confuse study habits with legal proof requirements.
Q4: A patient signs a form consenting to a minor office procedure after the provider explains the risks, benefits,
and alternatives. This is an example of which type of consent?
A. Implied consent
B. Informed refusal
C. Verbal consent only
D. Expressed consent [CORRECT]
Correct Answer: D
Rationale: Expressed consent is given orally or in writing after the patient has been informed; a signed consent form is
written expressed consent. Implied consent (A) is assumed from a patient's actions, such as extending an arm for
venipuncture, or in emergencies when an unconscious patient cannot consent. Options B and C do not describe a signed
consent transaction, and the scenario specifically documents written agreement after full disclosure.
Q5: Under the HIPAA Privacy Rule, a medical assistant may disclose protected health information (PHI) for
treatment, payment, and health care operations without special authorization. When information is needed for any
other purpose, which principle applies?
A. The information may be shared freely with any health-related business
B. The minimum necessary standard and patient authorization requirements apply [CORRECT]
C. Only verbal permission from a supervisor is needed
D. The information must be released within 24 hours upon any request
Correct Answer: B
Rationale: HIPAA requires that disclosures outside treatment, payment, and operations (TPO) be limited to the
minimum necessary information and generally supported by the patient's written authorization. Option A describes
impermissible sharing, option C ignores the requirement for patient authorization, and option D inverts the rule by
creating an arbitrary deadline that HIPAA does not contain. The minimum necessary standard does not apply to
disclosures for treatment.
CCMA Exam Review Guide 2026/2027 - NHA Aligned 2
, CCMA CERTIFICATION EXAM REVIEW GUIDE 2026/2027
Q6: A medical assistant wants to review the electronic health record of her own child who was seen in the clinic
yesterday. She has legitimate EHR access but no treatment role. Which statement is correct?
A. She may view the record because she is the child's parent
B. She may view only the laboratory results section
C. Accessing the record without a job-related reason and proper authorization violates
HIPAA [CORRECT]
D. She may view the record if she does not share what she reads
Correct Answer: C
Rationale: HIPAA forbids accessing PHI without a business need tied to one's job duties; curiosity, including interest
in one's own or a family member's care, is a well-known audit trail violation that can result in termination and civil
penalties. Parental rights to the child's record must be exercised through the proper release process, not through
personal EHR access. Options A, B, and D all permit unauthorized access simply because the information will not be
shared, which HIPAA does not allow.
Q7: An attorney requests copies of a patient's chart for a lawsuit. Which of the following must the office obtain
before releasing the records?
A. A written patient authorization or valid subpoena/court order meeting state requirements [CORRECT]
B. Nothing, because attorneys are exempt from HIPAA
C. Only a telephone call from the attorney's office
D. A notarized statement from the provider
Correct Answer: A
Rationale: Legal disclosures are outside treatment, payment, and operations, so the office must have the patient's
signed written authorization or a legally valid subpoena, court order, or statutory demand before releasing records.
Attorneys are not HIPAA exempt entities (B), a phone request (C) provides no documentation or verification, and a
provider's notarized statement (D) has no legal standing to authorize release. The response should be verified against
state law and office policy.
Q8: Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals of a breach of
unsecured PHI within what maximum time frame?
A. Within 5 business days of discovery
B. Within 30 days of the end of the calendar year
C. Within 1 year of discovery
D. Without unreasonable delay and no later than 60 days after discovery [CORRECT]
Correct Answer: D
Rationale: The Breach Notification Rule requires individual notification without unreasonable delay and in no case
later than 60 calendar days from discovery of the breach, with larger breaches also reported to HHS and, for 500 or
more individuals, to the media. Options A, B, and C are fabricated time frames that confuse breach notification with
other regulatory deadlines, making them classic exam distractors.
CCMA Exam Review Guide 2026/2027 - NHA Aligned 3
